MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297
SHA3-384 hash: 78a9385057525a9efc8a29dd3022fce363ade81f52a2c5f37671f3b0173e571aed43610353d264ac1183e55b901bcf30
SHA1 hash: e701f50b446dc19a31193146a4011ece90789b74
MD5 hash: 38ecb10e8426e725f94f292c719e8906
humanhash: mike-spring-texas-alabama
File name:38ecb10e8426e725f94f292c719e8906
Download: download sample
File size:2'036'736 bytes
First seen:2021-10-06 08:04:12 UTC
Last seen:2021-10-06 09:07:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 27516fd8750f40bdecf52a1420a0296a (12 x CoinMiner)
ssdeep 49152:qR/2UsYLRgI78/9KDY7WHaaNGCJU4YV5SFB/0KDiRE20Z:rUN1gRIDY7YaaNw4YG7m9G
Threatray 85 similar samples on MalwareBazaar
TLSH T1E29533AC9B7E5625EDDA97B0756078F69A11F2A09483ACCD1237F1CBC3560670BF680C
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
YUSU v1.5.exe
Verdict:
Malicious activity
Analysis date:
2021-10-05 19:53:38 UTC
Tags:
trojan rat redline loader
Link:
https://app.any.run/tasks/2999817c-ee17-4e57-aaea-80227a3095be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195320/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.78431.18396.28031.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Creating a process from a recently created file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
donut packed
Link:
https://www.filescan.io/uploads/615d587ee3d213d202b84590/reports/0cce5b56-4f6d-4c4b-8e98-2e1b7d25b60a/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/92c07c61-a724-4486-823c-fbcc5c429b24
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/865329
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 497758 Sample: DwFwR1vCvf Startdate: 06/10/2021 Architecture: WINDOWS Score: 76 44 Multi AV Scanner detection for submitted file 2->44 9 chrome32.exe 2->9         started        12 DwFwR1vCvf.exe 2->12         started        process3 signatures4 58 Multi AV Scanner detection for dropped file 9->58 60 Writes to foreign memory regions 9->60 62 Allocates memory in foreign processes 9->62 14 conhost.exe 5 9->14         started        64 Creates a thread in another existing process (thread injection) 12->64 18 conhost.exe 4 12->18         started        process5 file6 40 C:\Windows\System32\...\sihost32.exe, PE32+ 14->40 dropped 72 Drops executables to the windows directory (C:\Windows) and starts them 14->72 20 sihost32.exe 14->20         started        42 C:\Windows\System32\chrome32.exe, PE32+ 18->42 dropped 23 cmd.exe 1 18->23         started        25 cmd.exe 1 18->25         started        signatures7 process8 signatures9 46 Multi AV Scanner detection for dropped file 20->46 48 Writes to foreign memory regions 20->48 50 Allocates memory in foreign processes 20->50 52 Creates a thread in another existing process (thread injection) 20->52 27 conhost.exe 2 20->27         started        54 Drops executables to the windows directory (C:\Windows) and starts them 23->54 29 chrome32.exe 23->29         started        32 conhost.exe 23->32         started        56 Uses schtasks.exe or at.exe to add and modify task schedules 25->56 34 conhost.exe 25->34         started        36 schtasks.exe 1 25->36         started        process10 signatures11 66 Writes to foreign memory regions 29->66 68 Allocates memory in foreign processes 29->68 70 Creates a thread in another existing process (thread injection) 29->70 38 conhost.exe 2 29->38         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297/
Threat name:
Win64.Trojan.AgentAGen
Create hunting rule
Status:
Malicious
First seen:
2021-10-04 18:09:45 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
5221a9886df44c6e76d7a6d770ffe811d68cb8e6b96267e5ef40393ac675f6ff
65bbafc229aa726d189d7607d03b1c6835ddcdf8ad6ac90017749b051f6b0770
73c1188d93bd4318a830cb6d891aae7580a61c396ce37ba3676a321bbd3a137e
75359481a80ae7253f5a8859cc9d899020a24af197b95f8ef2716a9f011dc3b1
833ab773ed2c4e4cd2581d1e42bc5471f0621786007a8846aaf6cdfeccb198c2
92d222fc274d0c981a595327cf103960535339a655ae240f9267a84aedba7f41
9b8c70d1c0537d946bf7233df72a7e0ebdff2cb70404a69ee6a2419730973462
dc9787f1ca396af3c6a84f52c1f4a1969b7d33999507f2093480071fc22e9d63
fdaae3b3560efecbdf76d5a6751c1d7c5964bb0186b81575fedce4b394a8fe0a
+ 75 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211006-jywmvsagc8/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297
MD5 hash:
38ecb10e8426e725f94f292c719e8906
SHA1 hash:
e701f50b446dc19a31193146a4011ece90789b74
Link:
https://www.unpac.me/results/b0545133-78b4-4180-b296-8e49d6579686/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c178858bc5b0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c178858bc5b0763eaadbffe1d432de85a73c6f8ba4b7ce7f7bc98dc119532297

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195320/
  
URLhaus
https://urlhaus.abuse.ch/url/1657276/

Comments


Avatar
zbet commented on 2021-10-06 08:04:13 UTC

url : hxxp://cu85891.tmweb.ru/chrome32.exe